BPFDoor

lastmod 2025-05-07created 2025-05-062 edits

BPFDoor is a long-term stealth Linux backdoor malware: a highly covert attack tool that monitors network traffic without opening any ports, through passive network monitoring using the Berkeley Packet Filter (BPF)

Because of how BPF works, it can bypass firewalls and secretly eavesdrop on network traffic

About

• To disguise itself as a system process, it runs from paths such as /usr/libexec/postfix/master, posing as an ordinary service in the process list
• It runs mostly in memory and leaves no traces on disk, which also helps it evade forensic analysis

Features

A powerful variant that appeared in 2023 has the following key features:

• Encryption: previously RC4 → encryption based on the libtomcrypt static library
• Communication: previously Bind Shell → Reverse Shell, where a child process establishes the reverse connection
• Command handling: previously hardcoded commands → all commands are received in real time
• File names: previously fixed → now generated dynamically
• Even after being detected, it separates the child process from the parent process to evade detection response

Source code

See also

• Berkeley Packet Filter (BPF)
• SK Telecom#SKT USIM hacking incident

Favorite site

• Github - gwillgues/BPFDoor
• BPFDoor Malware Evolves – Stealthy Sniffing Backdoor ups its Game | Deep Instinct